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TNTHE CLAIMS : 

Amended claims follow. 



1 . (Currently Amended) A method for on-access computer virus scanning of 
files in an efficient manner, comprising the steps of: 

(a) identifying a process for accessing files and selecting virus detection actions 
based at least in part on the identified process if no identifier is assigned 
thereto; 

(b) assigning an identifier to the process if no identifier is assigned thereto; 

(c) selecting virus detection actions based at least in part on the identifier if 
existent; and 

(d) performing the virus detection actions on the files; 

(e) wherein the process is associated with an application program, a nd different 
identifiers are assigned to different application programs s o that the vims 
detection actions are tailored for the processes associated with the 
application programs . 

\y 2. (Original) The method as recited in claim 1 , wherein the identifier is cleared 

upon the occurrence of a predetermined event. 

3. (Original) The method as recited in claim 2, wherein the identifier is reused 
after being cleared. 

4. (Original) The method as recited in claun 2, wherein the event is the 
termination of an application. 

5. (Original) The method as recited in claim 4, wherein the identifier is 
assigned by the application. 

6. (Original) The method as recited in claim 4, wherein the application is 
adapted for executing the process. 
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7. (Currently Amended) A computer program product for on-access computer 
virus scanning of files in an efficient manner, comprising: 

(a) computer code for identiiying a process for accessing files and selecting 
virus detection actions based at least in part on the identified process if no 
identifier is assigned thereto; 

(b) computer code for assigning an identifier to the process if no identifier is 
assigned thereto; 

(c) computer code for selecting virus detection actions based at least in part on 
the identifier if existent; and 

(d) computer code for performing the virus detection actions on the filesi 

(e) wherein the process is associated with an application program, and different 
identifiers are assigned to different applicatio n programs so that the virus 
detection actions are tailored for the processes a ssociated with the 
application programs . 

\ 8. (Original) The computer program product as recited in claim 7, wherein the 

identifier is cleared upon the occurrence of a predetermined event 



9. (Original) The computer program product as recited in claim 8, wherein the 
identifier is reused after being cleared. 

10. (Original) The computer program product as recited in claim 8, wherein the 
event is the termination of an application. 

1 1 . (Original) The computer program product as recited in claim 1 0, wherein the 
identifier is assigned by the application. 

12. (Original) The computer program product as recited in claim 10, wherein the 
application is adapted for executing the process. 

13. (Currently Amended) A system for on-access computer virus scaiming of 
files in an efficient mamier, comprising: 
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(a) logic for identifying a process for accessing files and selecting virus 
detection actions based at least in part on the identified process if no 
identifier is assigned thereto; 

(b) logic for assigning an identifier to the process if no identifier is assigned 
thereto; 

(c) logic for selecting virus detection actions based at least in part on the 
identifier if existent; and 

(d) logic for performing the virus detection actions on the files; 
(c) wherein the process is associated with an application program, and different 

identifiers are assigned to different application programs so that the virus 
detection actions are tailored for the processes assoc iated with the 
application programs . 

(Original) The system as recited in claim 1 3, wherein the identifier is cleared 
upon the occurrence of a predetermined event 

(Original) The system as recited in claim 14, wherein the identifier is reused 
after being cleared. 

(Original) The system as recited in claim 14, wherein the event is the 
termination of an application. 

(Original) The system as recited in claim 16, wherein the identifier is 
assigned by the application. 

(Original) The system as recited in claim 16, wherein the application is 
adapted for executing the process. 

(New) The method as recited in claim 1, wherein the virus detection actions 
are selected by determining a category associated with the process based on 
the identifier, and selecting a set of vims detection actions based on the 
determined category. 
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20. (New) The method as recited in claim 19, wherein the identifier reflects a 
risk level associated with the application program, and a plurality of 
categories each have virus detection actions tailored for an associated risk 
level. 
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